CVE-2026-15384

Deferred Deferred - Pending Action

Manual Image Crop WordPress Plugin Authenticated Image Overwrite

Publication date: 2026-08-16

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in user. A subscriber-level user can therefore supply an arbitrary attachment ID and overwrite that attachment's generated intermediate-size image (for example its thumbnail) and mutate its stored metadata, regardless of who owns the media. This is a cross-user integrity/defacement issue over the Media Library. The action also has no nonce, so it is additionally susceptible to CSRF.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-16

Last Modified

2026-08-26

Generated

2026-09-05

AI Q&A

2026-08-16

EPSS Evaluated

2026-09-04

NVD

CVE-2026-15384

EUVD

EUVD-2026-59910

Affected Vendors & Products

Vendor	Product	Version / Range
manual_image_crop	manual_image_crop	to 1.15 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects the WordPress plugin 'Manual Image Crop' before version 1.15. It allows any logged-in user, even with basic subscriber access, to overwrite image files and metadata in the Media Library without proper authorization checks. The plugin fails to verify user permissions or use security tokens (nonces) for an AJAX action that crops images, enabling unauthorized modifications.

Detection Guidance

Check if the Manual Image Crop plugin is installed and its version is below 1.15. Inspect WordPress logs for unauthorized AJAX requests to cropping actions or unusual metadata changes in the media library.

Impact Analysis

An attacker with subscriber-level access could deface your website by altering images or their thumbnails. They might replace legitimate images with malicious content, change metadata, or disrupt site functionality. The lack of CSRF protection also allows attackers to trick users into triggering the vulnerability without their knowledge.

Compliance Impact

This vulnerability could lead to unauthorized modifications of media files, potentially violating integrity requirements under GDPR (data accuracy) or HIPAA (integrity of protected health information). If user-uploaded images are altered without consent, it may constitute a breach of compliance obligations for data protection and integrity.

Mitigation Strategies

Update the Manual Image Crop plugin to version 1.15 or later immediately. If updating is not possible, consider disabling the plugin until an update is available.

Hi! I’m here to help you understand CVE-2026-15384. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70